Governor Kathy Hochul announced that New York is awarding more than $9 million to help local governments strengthen cybersecurity at drinking water and wastewater systems, funding 153 local government projects through the Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) grant programme.
The award structure:
- Up to $50,000 per applicant for cybersecurity risk assessments
- Up to $100,000 for hardening and implementation projects
The grants help communities assess cyber risk, implement improvements, and comply with New York’s minimum cybersecurity standards for drinking water and sewer systems.
The funding was fast-tracked. Officials in Michigan and Minnesota reported cyberattacks against their water systems the previous week, amid a campaign that has now disrupted utility operations across at least seven states.
The Week That Produced It
New York is responding to something specific. On July 26–27, more than 30 Minnesota community water utilities were hit in a single weekend by operators exploiting a PLC flaw with no available patch. A treatment plant in Braham went offline. Maple Plain declared a local state of emergency. Multiple systems reverted to manual operation.
Four days later, CISA warned every water system in the country that “these threat actors are targeting water entities of all sizes” — a direct correction to twenty years of assuming small utilities were beneath notice.
Nine million dollars arriving a week after that is, by the standards of government procurement, close to instantaneous.
The Arithmetic Is Brutal
New York is funding 153 projects. The United States has roughly 50,000 community water systems.
Spread evenly, just over $9 million across 153 projects would average roughly $59,000 each — though the awards will not be uniform, since the programme caps assessments at $50,000 and implementation projects at $100,000, and New York has not published the per-project breakdown.
At that order of magnitude the money buys an assessment plus a modest hardening project: a network segmentation review, a firewall in front of a SCADA network, MFA on remote access, an inventory of what is actually internet-facing. For a utility serving a few thousand people that has never had a security budget, those are genuinely the highest-value first moves.
What it does not cover is the underlying problem. Censys measured 3,891 internet-facing industrial protocol hosts in the United States — 74.6% of the global total. The central vulnerability in the Minnesota attacks, CVE-2021-22681, is a CVSS 9.8 authentication bypass that cannot be patched, because it stems from a cryptographic key shared between Rockwell’s engineering software and its controllers. The only fix is architectural: get the controllers off the internet, or replace them.
A $100,000 hardening grant does not replace a PLC fleet. It can, however, disconnect one — and given that the exposure is dominated by devices that should never have been reachable in the first place, disconnection is most of the available win.
Why a State Is Doing This At All
New York is filling a vacuum, and the vacuum is deliberate.
The EPA attempted to fold cybersecurity assessment into sanitary survey requirements for public water systems in March 2023. Multiple state attorneys general sued. The EPA withdrew the rule in October 2023. The Water Risk and Resilience Organization proposals that followed have produced no enforceable standards.
There is, today, no mandatory federal cybersecurity requirement for US drinking water systems — in contrast to the electric sector, where NERC CIP has been binding and audited for over a decade.
So the mechanism available is money, not mandate. Washington cannot compel a municipal water authority in Steuben County to segment its SCADA network. New York can offer to pay for it, attach its own minimum standards as a condition, and hope enough utilities apply.
That distinction determines the ceiling on this approach. Grants reach the utilities that apply for grants — the ones with someone on staff capable of writing an application, which correlates almost perfectly with the ones already thinking about security. The utility run by two certified operators whose expertise is water chemistry, backed by an integrator who visits when a pump fails, is simultaneously the most exposed and the least likely to submit a proposal.
Voluntary programmes select for the applicants who need them least. That is not an argument against funding them. It is an argument that funding alone will not close a 50,000-system gap.
What the Grant Money Should Buy First
For any utility weighing an application, the sequence that matters:
- Enumerate internet-facing OT. Most utilities do not know what is reachable. Censys and Shodan will tell you what an attacker already sees.
- Remove PLC and HMI exposure entirely. Not firewalled — removed. Remote access belongs behind a VPN with MFA, and nowhere else.
- Inventory the integrator’s access. Third-party remote support accounts are the most common path in and the least documented.
- Verify manual fallback works. Braham recovered in hours because operators could run the plant by hand. That capability is a control, and it atrophies unless it is exercised.
- Audit engineering project files and controller logic. CISA’s updated advisory documents exfiltration of project files and manipulated Add-On Instructions — modified logic that can disable safety interlocks while operator displays continue reading normal.
Item 5 is the one that outlasts a grant cycle. Disruption is loud and recoverable. Silently rewritten safety logic is neither.
Sources
- Office of Governor Kathy Hochul, Governor Hochul Announces More Than $9 Million in Cybersecurity Grants to Help Protect 153 Water Systems Statewide
- SecurityWeek, New York Awards $9 Million to Strengthen Cybersecurity at 153 Water Systems
- GovInfoSecurity, New York Pours $9M Into Water Cyber Defense Amid Attacks
- Gothamist, New York awards $9M to protect water systems after cyberattacks in other states
